Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Researchers disclosed an active supply-chain worm campaign called SANDWORM_MODE that uses at least 19 malicious npm packages, a weaponized GitHub Action, and an MCP injection module to harvest developer credentials, SSH keys, cloud/LLM API keys, and cryptocurrency keys while self-propagating via stolen npm and GitHub identities; the malware includes a delayed second stage, polymorphic evasion capabilities, and an optional destructive wiper. Immediate remediation recommended: remove affected packages, rotate tokens and CI secrets, and audit package.json, lockfiles, and .github/workflows for unauthorized changes.